Merge pull request #5804 from superna9999/5797-remove-cipher-deps-tls
Remove Cipher dependencies in TLS
diff --git a/library/ssl_ciphersuites.c b/library/ssl_ciphersuites.c
index ee8a60e..7deb57a 100644
--- a/library/ssl_ciphersuites.c
+++ b/library/ssl_ciphersuites.c
@@ -1876,15 +1876,26 @@
size_t mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( const mbedtls_ssl_ciphersuite_t *info )
{
-#if defined(MBEDTLS_CIPHER_C)
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+ psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+ psa_key_type_t key_type;
+ psa_algorithm_t alg;
+ size_t key_bits;
+
+ status = mbedtls_ssl_cipher_to_psa( info->cipher,
+ info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16,
+ &alg, &key_type, &key_bits );
+
+ if( status != PSA_SUCCESS )
+ return 0;
+
+ return key_bits;
+#else
const mbedtls_cipher_info_t * const cipher_info =
mbedtls_cipher_info_from_type( info->cipher );
return( mbedtls_cipher_info_get_key_bitlen( cipher_info ) );
-#else
- (void)info;
- return( 0 );
-#endif
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
}
#if defined(MBEDTLS_PK_C)
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index 6f9100b..9fcb2b2 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -2137,7 +2137,7 @@
}
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
+#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
/* Corresponding PSA algorithm for MBEDTLS_CIPHER_NULL.
* Same value is used for PSA_ALG_CATEGORY_CIPHER, hence it is
* guaranteed to not be a valid PSA algorithm identifier.
@@ -2167,9 +2167,7 @@
psa_algorithm_t *alg,
psa_key_type_t *key_type,
size_t *key_size );
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
/**
* \brief Convert given PSA status to mbedtls error code.
*
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 8d6d379..5331865 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1838,7 +1838,7 @@
return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
}
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
+#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
size_t taglen,
psa_algorithm_t *alg,
@@ -1983,7 +1983,7 @@
return PSA_SUCCESS;
}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
+#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index 072c869..f3437a3 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -993,8 +993,8 @@
{
#if !defined(MBEDTLS_USE_PSA_CRYPTO)
int ret;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
mbedtls_cipher_info_t const *cipher_info;
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
unsigned char const *key_enc;
unsigned char const *iv_enc;
@@ -1022,6 +1022,7 @@
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
+#if !defined(MBEDTLS_USE_PSA_CRYPTO)
cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
if( cipher_info == NULL )
{
@@ -1030,7 +1031,6 @@
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
-#if !defined(MBEDTLS_USE_PSA_CRYPTO)
/*
* Setup cipher contexts in target transform
*/
@@ -1120,7 +1120,7 @@
/*
* Setup psa keys and alg
*/
- if( ( status = mbedtls_ssl_cipher_to_psa( cipher_info->type,
+ if( ( status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher,
transform->taglen,
&alg,
&key_type,
@@ -1188,6 +1188,34 @@
return( 0 );
}
+static int mbedtls_ssl_tls13_get_cipher_key_info(
+ const mbedtls_ssl_ciphersuite_t *ciphersuite_info,
+ size_t *key_len, size_t *iv_len )
+{
+ psa_key_type_t key_type;
+ psa_algorithm_t alg;
+ size_t taglen;
+ size_t key_bits;
+ psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+
+ if( ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG )
+ taglen = 8;
+ else
+ taglen = 16;
+
+ status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher, taglen,
+ &alg, &key_type, &key_bits );
+ if( status != PSA_SUCCESS )
+ return psa_ssl_status_to_mbedtls( status );
+
+ *key_len = PSA_BITS_TO_BYTES( key_bits );
+
+ /* TLS 1.3 only have AEAD ciphers, IV length is unconditionally 12 bytes */
+ *iv_len = 12;
+
+ return 0;
+}
+
/* mbedtls_ssl_tls13_generate_handshake_keys() generates keys necessary for
* protecting the handshake messages, as described in Section 7 of TLS 1.3. */
int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl,
@@ -1203,7 +1231,6 @@
unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE];
size_t transcript_len;
- mbedtls_cipher_info_t const *cipher_info;
size_t key_len, iv_len;
mbedtls_ssl_handshake_params *handshake = ssl->handshake;
@@ -1212,9 +1239,13 @@
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_generate_handshake_keys" ) );
- cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
- key_len = cipher_info->key_bitlen >> 3;
- iv_len = cipher_info->iv_size;
+ ret = mbedtls_ssl_tls13_get_cipher_key_info( ciphersuite_info,
+ &key_len, &iv_len );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_get_cipher_key_info", ret );
+ return ret;
+ }
md_type = ciphersuite_info->mac;
@@ -1408,17 +1439,19 @@
size_t hash_len;
/* Variables relating to the cipher for the chosen ciphersuite. */
- mbedtls_cipher_info_t const *cipher_info;
size_t key_len, iv_len;
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive application traffic keys" ) );
/* Extract basic information about hash and ciphersuite */
- cipher_info = mbedtls_cipher_info_from_type(
- handshake->ciphersuite_info->cipher );
- key_len = cipher_info->key_bitlen / 8;
- iv_len = cipher_info->iv_size;
+ ret = mbedtls_ssl_tls13_get_cipher_key_info( handshake->ciphersuite_info,
+ &key_len, &iv_len );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_get_cipher_key_info", ret );
+ goto cleanup;
+ }
md_type = handshake->ciphersuite_info->mac;